ATM software cannot be treated like a consumer app update. A failed image can take cash access offline. An unverified image can take security with it. The process has to be slower, more visible, and more conservative than people expect from other software.
The requirements
Authenticity of the package. A defined window. The ability to stage rather than push blindly. Confirmation that the machine returned to a healthy state. A way back if it did not.
Why this belongs in the same company as the hardware
Updates touch modules, sensors, and customer flows that the hardware team understands. When software and machines come from disconnected vendors, the update becomes a negotiation. When they come from one infrastructure, it is a controlled procedure.